acrstealer | 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39

Analysis

max time kernel
299s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 10.5MB
Sample260903-pbtsmsgm6v
SHA256 72208131742dbaf6871f648e297a054c8ad58cd318e4391772cdf4db34989a39
MD5 7dbe5a7928c4048d67413510bf15f3b2
SHA1 a6737313438f77142c2ac7c878dd40a31341d52f
SHA512 adf50f9432559b245c5029cbed4c91a8b0783078112a9f5985618ac6054b3f95e1c36b17fd4706c9e8eb01736205ca2e95d2c072e88f2fe7ffd5c6b3b1cff141
SSDEEP 98304:zOPwW4aV15KImMX+wP4UzFmt2a+sBZp5Fre0x7ahqR:GwW4ad6MuwPlz8Lp5Fre0xzR
TLSH
T187B65C6F72A8C12AC16EC27EC1A78F50ED33B0B51736C2FF529052655F12AC49E7E660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

sync.canyonmere.cc

Decoy

cdnjs.cloudflare.com

Attributes

ddrs
https://telegra.ph/C-Introduction-08-21
guids
01a034f4-51c1-7e0e-a650-137d7032a680

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 56 IoCs

resource	yara_rule
behavioral4/memory/3368-0-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-5-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-6-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-4-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-3-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-2-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-35-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-38-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-39-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-71-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-77-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-76-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-119-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-118-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-124-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-348-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-352-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-349-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-353-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-359-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-364-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-370-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-368-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-366-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-362-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-357-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-347-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-455-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-479-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-481-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1811-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1812-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1813-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1818-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1824-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1822-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1825-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1826-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1830-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1828-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1833-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1819-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1839-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1845-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1848-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1854-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1860-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1864-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1863-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1865-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1867-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1868-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1871-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1874-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-1923-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3
behavioral4/memory/3368-3589-0x0000000000600000-0x00000000006CB000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3368 created 4400	3368	wab.exe	80
PID 3368 created 4400	3368	wab.exe	80
PID 3368 created 4400	3368	wab.exe	80

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3368	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3212 set thread context of 3368	3212	Setup.exe	89

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2768	chrome.exe
4652	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329111682956370"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wab.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3368	wab.exe
3368	wab.exe
3368	wab.exe
3368	wab.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3212	Setup.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
5104	msedge.exe
1736	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3212	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3212 wrote to memory of 3368	3212	Setup.exe	89
PID 3368 wrote to memory of 3496	3368	wab.exe	90
PID 3496 wrote to memory of 244	3496	chrome.exe	91
PID 3496 wrote to memory of 5816	3496	chrome.exe	92
PID 3496 wrote to memory of 2768	3496	chrome.exe	93
PID 3496 wrote to memory of 5816	3496	chrome.exe	92
PID 3496 wrote to memory of 2728	3496	chrome.exe	94
PID 3496 wrote to memory of 2728	3496	chrome.exe	94
PID 3496 wrote to memory of 5280	3496	chrome.exe	96
PID 3496 wrote to memory of 5148	3496	chrome.exe	97
PID 3496 wrote to memory of 5280	3496	chrome.exe	96
PID 3496 wrote to memory of 5148	3496	chrome.exe	97
PID 3496 wrote to memory of 1640	3496	chrome.exe	98
PID 3496 wrote to memory of 1640	3496	chrome.exe	98
PID 3496 wrote to memory of 5828	3496	chrome.exe	99
PID 3496 wrote to memory of 5828	3496	chrome.exe	99
PID 3496 wrote to memory of 5704	3496	chrome.exe	101
PID 3496 wrote to memory of 708	3496	chrome.exe	103
PID 3496 wrote to memory of 708	3496	chrome.exe	103
PID 3496 wrote to memory of 1708	3496	chrome.exe	104
PID 3496 wrote to memory of 1708	3496	chrome.exe	104
PID 3496 wrote to memory of 824	3496	chrome.exe	107
PID 3496 wrote to memory of 4212	3496	chrome.exe	108
PID 3496 wrote to memory of 716	3496	chrome.exe	109
PID 3496 wrote to memory of 824	3496	chrome.exe	107
PID 3496 wrote to memory of 4212	3496	chrome.exe	108
PID 3496 wrote to memory of 716	3496	chrome.exe	109
PID 3496 wrote to memory of 1920	3496	chrome.exe	110
PID 3496 wrote to memory of 1920	3496	chrome.exe	110
PID 3496 wrote to memory of 1732	3496	chrome.exe	111
PID 3496 wrote to memory of 1732	3496	chrome.exe	111
PID 3496 wrote to memory of 4532	3496	chrome.exe	113
PID 3496 wrote to memory of 1272	3496	chrome.exe	112
PID 3496 wrote to memory of 4532	3496	chrome.exe	113
PID 3496 wrote to memory of 1272	3496	chrome.exe	112
PID 3496 wrote to memory of 1716	3496	chrome.exe	114
PID 3496 wrote to memory of 1716	3496	chrome.exe	114
PID 3496 wrote to memory of 5072	3496	chrome.exe	115
PID 3496 wrote to memory of 5072	3496	chrome.exe	115
PID 3496 wrote to memory of 4932	3496	chrome.exe	116
PID 3496 wrote to memory of 1900	3496	chrome.exe	117
PID 3496 wrote to memory of 4932	3496	chrome.exe	116
PID 3496 wrote to memory of 1900	3496	chrome.exe	117
PID 3496 wrote to memory of 5172	3496	chrome.exe	118
PID 3496 wrote to memory of 900	3496	chrome.exe	119
PID 3496 wrote to memory of 5828	3496	chrome.exe	120
PID 3368 wrote to memory of 5104	3368	wab.exe	121
PID 5104 wrote to memory of 4976	5104	msedge.exe	122
PID 5104 wrote to memory of 3720	5104	msedge.exe	123
PID 5104 wrote to memory of 4652	5104	msedge.exe	124
PID 5104 wrote to memory of 3720	5104	msedge.exe	123
PID 5104 wrote to memory of 3720	5104	msedge.exe	123
PID 5104 wrote to memory of 5840	5104	msedge.exe	125
PID 5104 wrote to memory of 5840	5104	msedge.exe	125
PID 5104 wrote to memory of 2316	5104	msedge.exe	127
PID 5104 wrote to memory of 2316	5104	msedge.exe	127
PID 5104 wrote to memory of 692	5104	msedge.exe	128
PID 5104 wrote to memory of 2316	5104	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4400
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Program Files (x86)\Windows Mail\wab.exe
    "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff5e21c728,0x7fff5e21c734,0x7fff5e21c740
    3⤵
    PID:244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,1469484239714103137,17103565726073693899,262144 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:5816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,8338415582400725070,3846547048938482178,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,664944527157842033,5865282567203337935,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
    3⤵
    PID:2728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,15727738693714456287,4885952218904234890,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,11229008476646704212,5429110172231474267,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,3821129958399763233,18330669317423992347,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,14523793180940647368,1878987473921290055,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,12433644131839264079,497942055425656161,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5332,i,9380655223433180612,7445159793140009877,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5368,i,1859992437942365964,2456982106765632841,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5412,i,9669156741926555333,12010809339399449163,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5344,i,569847490661198893,3648962772677483995,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,9955339809574897867,14011229358997585520,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5648,i,15660938291196287151,17311995890276018866,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6240,i,5818005680338280963,8865042985211342381,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6204,i,26787293718694897,8021055348961135744,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5904,i,6851495089997545342,9024952213518974379,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,13632961496020933393,749361392926468975,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6348,i,13498005493050613722,7510879340964290951,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
    3⤵
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6740,i,13928650120433033753,110156409580012408,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6616,i,5032865884491976508,4558718084674901644,2097152 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:9
    3⤵
    PID:1900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,14820597953319293682,7816784728094308203,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:5172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,17299722965293614743,5496425326106682648,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,4200071374034893058,6255281844299138459,524288 --field-trial-handle=2024,i,9407879157976711664,15451945322577688344,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
    3⤵
    PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff46e4c188,0x7fff46e4c194,0x7fff46e4c1a0
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,6740691394445543784,3532805813367481578,262144 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10119305325381225232,17334647808349199678,524288 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,7484865003984392095,16784559605196807812,524288 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,16885105672171602439,17827868235186758662,2097152 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,17677473987698496284,7238868598211688120,2097152 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,14025223738113521767,15057835777715752284,2097152 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,13656716518383831150,1654386820675335334,2097152 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,8209790852191923221,6814602283331162388,524288 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2489952653011064952,6449436523219317656,524288 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11630083833148435755,15493153244980448792,524288 --field-trial-handle=2320,i,5458364180925656669,14168632168568140757,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:1736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2780 -prefsLen 24445 -prefMapHandle 2784 -prefMapSize 268548 -ipcHandle 2848 -initialChannelId {941542ae-4d71-4fa8-8968-b75bec278751} -parentPid 1736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1840 -prefsLen 24658 -prefMapHandle 1956 -prefMapSize 268548 -jsInitHandle 1732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1872 -initialChannelId {e1d6e5c3-0610-4975-a3fa-fd5560c8afdd} -parentPid 1736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3752 -prefsLen 25542 -prefMapHandle 3756 -prefMapSize 268548 -ipcHandle 3784 -initialChannelId {575f13f7-8bc0-4d89-af0f-e85819b0f217} -parentPid 1736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1736" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4144 -prefsLen 25604 -prefMapHandle 4148 -prefMapSize 268548 -jsInitHandle 4152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4160 -initialChannelId {e31a0e11-6c79-4d65-9c37-fbda10998e31} -parentPid 1736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:6108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 36449 -prefMapHandle 4960 -prefMapSize 268548 -ipcHandle 4968 -initialChannelId {fa1e105b-18ae-49bf-b8cb-6774db231c01} -parentPid 1736 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1736" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      PID:4812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 5d2f885dcce3bc58fb62f26864f4c49af39343daa5aec624ba0dd911681cd7dc
MD5 0660608daf7c9518ed96835c3aea2bb5
SHA1 7f73e095bdde43d4a7108bef326d9cea1600cdc6
SHA512 b86803d4fb7d7e59a9f6e80578b75015a7d2346269bdbfd75e2801a7c27b2b9abe2f97c775492737249a31258575407c1d9463b2ea08af501bcd6f407a7ea13e
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd5cO1+Uvvj:TeW9aw/aHLopFMavU1iBNHcKv7
TLSH
T1BB92238F1F307210C4F48736EAD2099B1E7D222C9363AA99ED5414F38D824ABF5061E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0d4db989bc5aeaa712aa5620093ad6d632c83c229aff253e1323d4ef91b44917
MD5 6e6250e4ae9147f1a95eec6af410c9b2
SHA1 46c812e543490a9414638d7c200b1be9242cd0b4
SHA512 75a41ba1cc4aecf8e1245592c6449f3c057ab1ecd83dba22b649d50f9cdac7e229c9bc4b6fe1ba68449df2e8821d6b2dc55df67b4382bd680b5c890f3699f002
SSDEEP 192:jRd3CYVv7hAPRp2l98Hsb+WNn6h0QknkwPaIJVyIsnAUge:jRd3tlAXauwE0HvaIve
TLSH
T11E32D62EBA54797B6DCAC21AF9217753D3F5102161E42E84E7FC8A6C14E79CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 b6516fb1940ad168b797b2b68abbb6067a56cfd78d14b66f08445d2063266d04
MD5 1464f2b34e63cd1901f4002bdea9e9ff
SHA1 fa11f009870e44371c2a1c36aa8e412e53910e1e
SHA512 f085e97fecd22b91d1df5368c2b4e7f385f1ca9a20acb2227506f9b7ed04e44a60cc4e18e1842f051bb411d82c42e3c0a7f4b6c16e5f334153a29b876ae390b1
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3hZHG8t2rVge:MKm97KxkXqKf/pUZNCgVLH2HfgsLROq5
TLSH
T12452F867684D9A3B0FD8C98CDC276F8BACB6015762784D2456FB5D0803A5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d4dc419b255f86031c7f232e73caabbe31beff0505d9e4e712591bd9683d6cea
MD5 2b41523d6ab3ca8b02a0ff5eabef117e
SHA1 4ac09dda4b520d4862cf7ecce74b14059c593014
SHA512 ebf01bb2ab2862542892683f8725d1a5a3b0e16547f156a82b96d94c461e26b4998f428fbf74251875f3c08f450d5e4c7d32d1d4bb9caeb0c6e8686df2a8ff7a
TLSH
T135A0025042C0195DED95437469A646953291481A3B75C35356A18449CCAB1C1F591275
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5380.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a5380.TMP
Size 48B
SHA256 2a1f56328d0d0f08941af1b3f4e4b30261387d32d20d135b54b6a29b46e4f3b1
MD5 c837be230d59dc9ac90535d8fd6afea2
SHA1 0f4c4d459c3f7942d3f05cc8d8753ce50d5341a1
SHA512 e56f94d6cd27c0237854ad4c4ca90b437eb0402eef7e76ce0cc004ddcfe0876d354e4f14d9051b8a311b5a2860ca873a89e2b40397e7a94aca16388f924291fd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 7b5b3d415c84e348f2732a54cb1704eb233e150a3d593f617eecb4cb4e7ae51d
MD5 565f98a4e3b1e1a6627698bf369b2648
SHA1 29c31eddf25ff45ec1d11c827bca45a5fb5374cc
SHA512 501a95323b4b2793f8f6377de4ace719f471704a7bce9a68f6528012784659197d78494d28a947e6504d6a38707db65c0049d4e262ec7d9e17ed7fe664e30018
SSDEEP 3072:3bvX72oIkSMN7o7pfLmxUVJq0AY/3EK48A0jnbh+ZZK3NxC:LvSoFSdIxUBB/UJCbbYZZUxC
TLSH
T1B9D31230983A6C374AEEDD2D10574C1FCAE08AB7BC4BE678C5901B4724B791E9389E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 47b5b37db43e137164a8ac3a49dfb43631a20250e0073061963bd388ec436e5d
MD5 7ab3e8411c1f77a21d827e20656297df
SHA1 425955d40b0dbbdb11251a31751e34d91d15101b
SHA512 675d8de1c29f0de53d4eee6d21fba426f435de139e1dd7dd67159cb084dbc43c865b80f64e1d75f1f901c093091a93260f32b962259739043f923130c6d3f9ce
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5KQHDeB6eGyvkonvob1v4a:MC0HJm5FHuPgXDUDZeW8nvobZ
TLSH
T160A12CF1A4B94CB759B7D745F8823A83DEA4A22769A1EF80D9DD1F0C01F31E81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 1fc982aea78d04419be024a97fc5f4008976a55ced12d93c4fbd26643637de06
MD5 0a3f3b0da5ff37a1a38901fb61c152d1
SHA1 ae5af1747491a815b087d49750db8590cf12c233
SHA512 66fbdcde4f79c870f59e2c4aec25238337a77caffc5095933f33dbb6be330afaac2cea0f8bda8cc232b4f3b65d2f61a2e967b0ead2f14d395f5b2f0d87bb3d95
SSDEEP 3072:ibvX72oIkSMN7o7pfLmxUVJq0AY/3EK48A0jnbh+ZZK3NxC:WvSoFSdIxUBB/UJCbbYZZUxC
TLSH
T1C4D31330983A6C374AEEDD1D10574C1FCAE086B7BC4BE678C5901B4724B791E9389E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6e0414fe-9ad0-4c29-8237-6a8fbdac6f36\index-dir\the-real-index
Size 72B
SHA256 afb169a378868f3c72f26d53205f45068fc085c9de85ae466b3fe5cd76324368
MD5 39d73a5c67b3cef04ce1dbccfa2c7480
SHA1 49a4a9d87bd68d7b4cf8a94806c999ccd91fad05
SHA512 fe4bfcea781fdbba159e0de0eeff2f0602900966588464483902be9e547df0060e6b34a721297bcee9aca791aad55ffc0003507158100d65e1982b5639723513
TLSH
T163A0021A46813040D08226F21AD71165535149D00100137550D0404CE8D8B4555A600E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab4f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6e0414fe-9ad0-4c29-8237-6a8fbdac6f36\index-dir\the-real-index~RFe5ab4f9.TMP
Size 72B
SHA256 b17960b489b55a226081045e0f7333bdb1f5077b31b06cac304e616812d1b5e9
MD5 ebe4fbef0ee5d3197b8a71fa4e841b53
SHA1 6222c95d859205a15f4659a86c75dd0696675870
SHA512 36aa42a480fe701380e3040ae567a0f769336b5f761c8a5a658d20663729b19e21795d95f1a2f334aafa39ef87361ea428ba1189ea47287525f6833c5a8b6c47
TLSH
T121A0021113C14047D0E236B15FD7126512198C50B500220656D10244EC50964458300C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 902e1a8994f7de6cf0f46fcf4b25130777bb20a3b648f45a0ea4198f5855ee88
MD5 cac9343f73c4e4c99d12c3d7a2b41e9d
SHA1 c7738c8379f076b08dde1e33b3d3e72a7d8ee66f
SHA512 721f0c4c7768a8307116150455a5c6c421a3dbc430f346796486f1ed83b3c39de39aa4a9a829a8b0d2d9b4eb199a5730af2021a08e01b994c1b0c67ad015d911
TLSH
T166E0D8BA2EE62820EADFD2D6343115E005067D749908AD5F546BB1D730F1615A557C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 26c0bb3f69240f5c09743235f5057778d65de382f8350b69c866574b61fcb106
MD5 496d02429a1c17864565b149359a5625
SHA1 e6a6732a145af70c4f6f01128dfe3acc8d557be5
SHA512 10d46a47a194f280baab116a547f24cee200b676c3344d79f5078206bbf8e9ae7e712587680b147c5519d6b96757cd62cdb85752df05bc9c97676b3282435512
SSDEEP 768:grv+4UNbdD3mLJlNp8+p3bd66j+4BRv86aLITa2bwCl1:gbsbp3ML8+p3Z6n4yb0ww
TLSH
T17003AE72F4A9E9739CEAC644B14677837FB821A399C10EC4E4D96B4E005A19E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1611911f66e767fd0cb4dc3226717ad74019080b8bccea3e3cb2acf80b4cefc0
MD5 d6464d5a2e6621091b8f77ec65a8fe53
SHA1 55ec15c7ee046dcf14021cd5cec699d096478402
SHA512 7dac8969e23c54f1b24349432d6435784dac31e318d9310f978f56dc6c26203c3c94c285ba45da749be6a743b8f02c13e9e5689f42c83dd62ca9f384b3f7ba6d
SSDEEP 768:Irv+4UNbdD3Uc4Np8+p3bd66j+4BRv86aLIi/2bwCl1:Ibsbp3EL8+p3Z6n4yV0ww
TLSH
T1F303CE73F8A899739CE6C644B2467A437FF861A396C10EC4D4DD2B4E419B19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 573KB
SHA256 edc2a572c854afe9093725c2352561cad86cfa538081c21fe95e49cdd2ea989e
MD5 5c92e1527b771317f0d5de7f1dfa3ba5
SHA1 78ed17717cb8b2363bdf04891ce9327da22d9ce7
SHA512 b6040d473dc5a487a6f6599850dad8785d7b621a4b29167047b901ca57b2126302ee07b41570d89b76c9a1745058c4fb73ff7781f21a9d25cf5b84f164889e5c
SSDEEP 12288:BiHVTZ0PuwnimEaldw8Xv7n1I7NvewjaW4ne6om5YescParlCi3tn11XD8R2u:BiH1ZGuoFEal+8f7n1IZGBjpoIPvyrlK
TLSH
T108C402F5F7A07CF3A7BE034A9D85AFAD07664622C74FA08C443B2BC2455372AAF65504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_1704298423\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 ee968f94e4b4f4997a8f61675a8f5f92fba96535a1cea9c163f5dba878f13e7b
MD5 a11a20883430f3647819141bd6969db2
SHA1 559f8e3b9d85b8b128b6de538bbe338c7314c41b
SHA512 9560b495619d9f5a3374017bf1a123ffa97762e98c5f3dfba119b79cf5ae3e18a43ab62bf4769eb743021529bd625410cf6790ffb2e633b622093125dd6dc351
TLSH
T193619658E6298A3FE445813ADC564B005F783958986E2F2F369C704E2D4B3DE3B8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 988a655e9b4ac1a8f5683490ce342ed8496772104a3ebf11a1bcbbc15f1a85ff
MD5 7e6def2e383fca4f24df18051bc118c7
SHA1 559d70a9722bdc2cddcd27d664c5096aa9c3f4c9
SHA512 fb105a09196e6f8144677685712250de11ba92851e6d2b2571934365bf78b33845896ccd516d2f3df03de21244e6535e04287b118837f2813b0fce7081959db0
SSDEEP 192:oOv5zbo87SFm1d66JoztdzgCl6mBO6mBMWM2fgCl6mBM2cMBM:Tbo87SFAd66Joz/zgC1AO5GgC1O
TLSH
T173D1BEA5E9188B3FD404637ADD911B098F3C3599980D2F1E299D6118295F2EE378D0FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 24963e7c6c8849075ac612785caab6b9b49bf3ad61ca920ec1527cb0c787d7e8
MD5 b097a5f45e6ef414181c27c840fbfa31
SHA1 6e07dab546106ac951edd5c5fdb0dae23ebe1752
SHA512 48ba596cef3f1a4af50c18c92c8a9455f5f81ff5a17e14e47393630342a2aceb20f55d78a6aa922d987de8a62568e5090ad222fed55e5fef12a7bee3ef7ebc73
SSDEEP 192:tOv5zbo8l4QSFm1d66JoztdzgCl6mBM2fgCl6mBM2cMvCl6mBM29M2:Cbo8lVSFAd66Joz/zgC1OGgC1OkC1O/
TLSH
T18FD1EF64E6288B3FD440523ACD921B084E3D3999D81E2F2E29DD715C2A5B2DE378D0FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 1c4081e768f98652fa711941eaacd221f88b07371abedff87531da67913f8f40
MD5 46aead0f948cd8874626f4bcd4c850b8
SHA1 b3b633a8ec3d92ee3f423a0111db0c85c09fa8d0
SHA512 93f87f26eda250dd13d97c9d58fd20a134f3110589325df88df95bffb5d745bbcb59816dfba0fb75582d11d4e0e8d1a3433a599a5acc01511e5c5a48108f42bc
SSDEEP 96:tSdF95/7bkW6ArlyUR64xzF5iF5Fm/dd66JoztdzgClKtmBM2/u:tOv5zbo8lyjqrSFm1d66JoztdzgCl6mY
TLSH
T1BE91BB28F229863FD455423ECC615B000E36399AE85E7F2A31EC74593D562DD368D0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 67e2cdf5178ca0ef42fad1b279c830967ca19ef09f116a7ceaaa737425de7ef1
MD5 9a37bed46dd5653c6520b6ae142c00e4
SHA1 eb9320bbd1e301defbf1d015999467b0c17617b0
SHA512 f30781563c2bbac42610f98d37b14b957e52ba147b6930b4ae23d51b6d650cad5142cf5ea44d8542405ad2539d549d5a104379a21a9bb2421526ed2ac698670e
SSDEEP 192:vSFm1d66JoztdzgCl6mBM2tOv5zbo8lyjAMiztdzgCl6mBM2:vSFAd66Joz/zgC1O7bo8lyj4z/zgC1O
TLSH
T107D1FC64E628873FC444533ACDA11B044E3A399AD81D3F2E39EC7559395B2EE368D0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7f4fbbbe42ba6dd5e03ee379b4617f0a03ba6917abc8db03f961fb427730a2e7
MD5 9a71957bd226cfb09822d55bfc5bac61
SHA1 9da276964b91c3c2f1de485e4ed05d751fd08c19
SHA512 3d55aa77f8d8bed7dab48e90ce2cd0c43638e9cbfa912b0e9832cdcba5a02c9346e4c768e6eb54abad841e60c102bdede9cae6e1f0c2483fb950f9bf133b8b3b
SSDEEP 192:8Ov5zbo8WoHyj0MCSFm1d66JoztdzgCl6mBM2:/bo8WoHyj0SFAd66Joz/zgC1O
TLSH
T1E8D10E64EA288B3BC404537BDDA21F044F3A395ADC4E3F29359C6518294B29E378E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0864c902d6695697a581df9821c3ad0188940d88eed79d4a8d541f7b7b7b406a
MD5 bd0a5dc2dbe3f45da82ca210999cca09
SHA1 cd67cac506b120a55809ae3b72f0b99109a775b5
SHA512 0a9eb9ddd9c47a8a8a2fc7c34877f5b68384917902c5476c352061c78ddaeed258c8e7f57c4b9812638bdb5fbe58a97baf3ee1e1f445af9cdd1f5740333dcf5a
SSDEEP 192:4SFm1d66JoztdzgCl6mBM21Ov5zbo8WoHyj0M:4SFAd66Joz/zgC1OTbo8WoHyj
TLSH
T18DD10D64EA288B3BC444537BDDA11F004F3A395ADC4E2F29399C2508294B6DE378E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 399cb7f3184fcdf8f59acd450bf21aaa6c1f00d97b9e55b7c84f1f2e8d0f3351
MD5 dc2b7b2636be3eb34715db9f260822ec
SHA1 3744c3c6895d18cfec6db9dd5ed9aae6b1f5434f
SHA512 aefd3fbe7b10ee1921063503d08b5d6d0cf0b16587b13261e2c02025e57e325552900739b957b5bed079646e26e27d11d84ce97165a4067afd19cede7d87a818
SSDEEP 192:6tqFm1d66JoztdzgCl6mBM21Ov5zbo8WoHyj0M:6tqFAd66Joz/zgC1OTbo8WoHyj
TLSH
T1C1D1FD64EA288A3BC444423BDDA61F044F3A395ADC4E3F2935DC25082D4B2DE379E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0fab75245005fc09a92299788f0d25e7545e4422981e0add9e4bdca0b013bac6
MD5 088ce5931d74b1abd48a1c0a9adffc55
SHA1 f27a699c8e2eb61438c9eeb75f42aea1440f7948
SHA512 ad14d06f77c0dc985e8ae2730649659415324bfd18eada15dd7862c551c77007aecb43c9949466f43594e9ec2321e6d11d6f9fb305f3b4fcb97ce176d4378a01
SSDEEP 192:8Ov5zbo8WoHyj0MStjFm1d66JoztdzgCl6mBM2z:/bo8WoHyjktjFAd66Joz/zgC1OG
TLSH
T118D1FD64EA288A3BC444423BDDA21F044F3A395ADC4E3F2935DC25082D4B6DE379E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cb6ab2ce47ea2b77c368fc2b5e05ec02409a8870edacda83e98519181a692280
MD5 5d92397d5da17ccf886023fabca60e35
SHA1 8de04ff5a94cfc4c21c827ea66c65f1298563f1c
SHA512 5e498f67daec5aceb66514a411e6df5dd6c67a24b65e61aad9c3d5807e5e189a394408795d550c977972bebabef0160001c6f82e2c20f4291361238d6624646a
SSDEEP 192:KOv5zboAasoHyj0MntjFm1d66JoztdzgCl6mBM2z:pboAasoHyj1tjFAd66Joz/zgC1OG
TLSH
T1F1E1FD64EA288A3BC404027BDDA21F044F3A399ADC4E2F2975DC241C2D476DE379E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 1KB
SHA256 44f5e06e2ca6c60b9db4fb1372dcbc7d7d72f96687fd7be6ecae7cb126dbe08e
MD5 bb46a9b5f4dc41cc5a733187f987d651
SHA1 b6b455be27439265bd1c7210a90d39d1abdb5f4e
SHA512 218292327ac8b4f8863b4dde376ef1dce30a7e343851d3d3b8b2e5b55bb658c6507f07af677674a4f3c0b3d9ff46de7e8a5a8edab8bd8e47bb3cad031c919c6c
TLSH
T13631571C3AE18DA5DDD7F29C5060824BD3350A53E5122D43AD35FBC9C9806D53158A3C
MD5 SHA1 SHA512 TLSH

Submit Download

50912951-f945-4e9a-8719-c0fed051c3ee

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\50912951-f945-4e9a-8719-c0fed051c3ee
Size 235B
SHA256 7b1137812aa201ff9a36427ce70e2a71339275f2985de49fd5553fc6a53b7f97
MD5 1c9b3a720c72d92ab7258240357e7ac2
SHA1 9d42aac9daf71fcb3b02fdc577bde35334b849cf
SHA512 7f925fb21af252666fa13245813661c404f4291eeee3c03e45a6ebd9348a1a160844ca10148bd89f46afa6378bd17dae0a58fa3812fe0e2ea797bbfc84b42eba
TLSH
T129D097D02C98636D0C280F47B0E028C632884C3714BDA8109A9101788EF9DC842A2856
MD5 SHA1 SHA512 TLSH

Submit Download

fa99b4fa-4e2b-4dd2-ab5b-3112983524e2

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\fa99b4fa-4e2b-4dd2-ab5b-3112983524e2
Size 796B
SHA256 0fa1210c59d3919e19de719b239cbc8fc55aa09354d1bbb118c68e8e269eab16
MD5 f09a5bce72814214d09b9ff23e3688e1
SHA1 85f1dc77a823f0e3230941914d011efdc9c39c4e
SHA512 4ac1b1d0c19a8758d2da6e1b3e03fb8749bdbe4f31998c5e0ae54bf8311ac3cd43bc827b72f4ceaa213d0f7070fc8410b7b74ae3be4056cd0a034e2a1b1f7381
TLSH
T13301F1918535B9B3CD79D21BC9A23B448FE87433C0DB88147D75D6180A6A01EA37E60F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 3360ef249cffb2a58c879e9b8be66f8279f165632fe271c7ff7c41b10a042039
MD5 d905078e9808b2c8839f5768d073e8b9
SHA1 ab25fd8d62d9e1f878bd756c8ae35d88b281a699
SHA512 d793fa6ee562b1ece73e7a260f4a3e8704a5d8b371ace5da8e223514e1f47394e1437fc25c8c4132c56ed7ade50743c44efb41e0f474087d923ca7da5ad8691a
SSDEEP 96:xHaEqGqIdFzvr6ElW9hnK4u8g1w8hGcn0v:s3RIdh6Ej4u8g1w8h2v
TLSH
T18DA12E786454CB6F64B6776CAC658C715E72013BB7BF688610A58484010CF3886F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 a0a2492fcc25b5960e3ef930ba2fba61d322aad0eb1b7c4a2610a700db9737d0
MD5 2544d374173811f38b07145812f0b3be
SHA1 9c14250082beb92e1252336caa4c0fcfbbdd4ff3
SHA512 0e4d87f62197e34e8c2e96c2f3a410a69a1601e406fae95c73ea794ddf24926eb65222a5120490b14fc59a42575440ae86cb737665449844060e1fc7665e99bb
TLSH
T12C31ECA55945CF6FA1B976ACFC154960D762013AB77F9C4224B890864118F3402F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 3d0e5011c1f6ef575df3b75cb2e5d739c50ac4b88ce0e09eb85bb0c5af542ef4
MD5 321172076112f7df5ed847b8e7d8a4f5
SHA1 fb4f43d99be5d7b8c3b599ae573b357c6fb1d541
SHA512 435aba584d383b264f8f7a62efa46f5265ac72332f430ba3fc7b36972d160f8dcf773ceb44b475b5829f9344e4f274db76ec5b97f9d63827e6102a9f45d6ef2d
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0mV23Cfi2f6E2A/2g42cRCH2ZMNXCK7mh980X:Oa16S6CdFAW/V4CfiaR/skZhJ730X
TLSH
T12823458D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 368KB
SHA256 6775c1520150cc88a0e2031783175c5c9ba86029d2337c4974f32cd4efdfcfd6
MD5 f9d30e15daaa6c8d2795fd509b61fb97
SHA1 49dfc1495a60591fc205b5caf08b0fc3a1d70359
SHA512 6872dcda3c93c223e8ede09b9c7a46e8b45230bc46c60e68664ac00a595cad29ba5da37523f66e20759d91604c29788a201c61009cf575af53974f2d4e4db534
SSDEEP 6144:dxaY3p6x3g7cHLeHG/KTS4Sq2tbTtR5IpBxv6uazijr:dfvSijr
TLSH
T16784E7A53061C197C321D83B9B5DB3AB243FE29894E3E78893701708396EA1F7ADD315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-15-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-32-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-11-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-10-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-9-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-1862-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-13-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-1190-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-1877-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-14-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-20-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-16-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-604-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-17-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-18-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-19-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-33-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-12-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-31-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-30-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-29-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-956-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-28-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-27-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-26-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-25-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-996-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-24-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-23-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-1013-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-22-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-1029-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3212-21-0x0000000000480000-0x0000000000FEB000-memory.dmp

Download

memory/3368-38-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-348-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-119-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-39-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-71-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-77-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-76-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-481-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-479-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-455-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-347-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-357-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-362-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-366-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-2-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-3-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-368-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-4-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-370-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-6-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-364-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-359-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-0-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-353-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-349-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-352-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-5-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-35-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1811-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1812-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1813-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1818-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1824-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1822-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1825-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1826-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1830-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1828-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1833-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1819-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1839-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1845-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1848-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1854-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1860-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1864-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1863-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-124-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1865-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1867-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1868-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1871-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1874-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-118-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-1923-0x0000000000600000-0x00000000006CB000-memory.dmp

Download

memory/3368-3589-0x0000000000600000-0x00000000006CB000-memory.dmp

Download